Not bad, but he should have noted that the link should be sent to the victim's email address, not facebook. You might have the one guy wondering why he is seeing a login page for facebook when he was already on facebook!

There are a few ways to remove windows 7 passwords it depends on what access you have.

Hiren disk has password remove on it

There a few good video on security tube too around this area I think one shows using windows 7 cd to replace sethc.exe with cmd.exe then when you boot you press a button and get a cmd shell but I cant remember all the details its worth looking at.